chevron-down Created with Sketch Beta.

    Business Law Today

    February 2024

    A Discussion of Risks Posed by the 2023 CMS Final RADV Audit Rule

    Sabrina Skeldon

    Feb 15, 2024

    12 min read

    Business Regulation & Regulated Industries Health & Life Sciences

    Summary

    • The new risk adjustment data validation (“RADV”) audit final rule issued by the Centers for Medicare and Medicaid Services in 2023 is expected to increase both the number of RADV audits and the potential liability of Medicare Advantage Plans and providers.
    • The 2012 RADV final rule that previously applied involved a stratified selection of plans for audit, a specific process for calculating extrapolated payment error, and use of a fee-for-service adjuster (“FFSA”) to limit audit recovery to avoid underpayment due to differences in documentation standards.
    • Evolving from the 2018 proposed rule, the 2023 RADV final rule eliminated the FFSA, removed limits on RADV audit methodology, and indicated payments from 2018 forward would be retroactively recovered.
    • The 2023 rule will likely increase providers’ exposure to increased, unexpected losses in RADV audits for earlier periods with a final reconciliation. Also, because plan revenues will be uncertain, the rule will likely impact enrollee decision-making and participation.
    A Discussion of Risks Posed by the 2023 CMS Final RADV Audit Rule
    iStock.com/Andrei310

    Jump to:

    On February 1, 2023, the Centers for Medicare and Medicaid Services (“CMS”) issued its final rule on risk adjustment data validation (“RADV”) audits. The rule expands CMS’s scope with regard to Medicare Advantage Plans, by authorizing different sampling methods and audit techniques and eliminating the fee-for-service adjuster (“FFSA”) offset from 2018 forward.

    The Final Rule is expected to increase the frequency of claims audits as well as the potential liability of Medicare Advantage Plans, physicians, and other providers. During a RADV audit, CMS looks at a sample of Medicare Advantage claims and confirms that any diagnoses submitted for risk adjustment are supported in the patient’s medical record to ensure the plan did not receive an overpayment. Changes in sampling methods and extrapolation of overpayments affect both the frequency of RADV audits as well as potential overpayment calculations.

    This article discusses the increased risk of liability for providers who are parties to Medicare Advantage risk-sharing arrangements resulting from the 2023 RADV Final Rule. The 2023 audit changes represent a strengthening of CMS’s programmatic method of assuring accurate payments under the Medicare Advantage program, through an expanded scope of the RADV audits that authorizes different sampling methods and auditing techniques, and methods of extrapolation and calculation of overpayments.

    Medicare Advantage Risk-Adjustment Payment Methodology

    To understand the evolution of the 2023 RADV audit final rule, an understanding of the Medicare Advantage payment methodology is required. While the intention of the Medicare Advantage program was to provide coverage to enrollees who require increased health-care resources, the abuses of the model have resulted in an expanded scope of CMS RADV audits and increased regulatory scrutiny of payers by the Department of Justice.

    Unlike Medicare Part B payments, which are based on procedures performed, Medicare Advantage payments are diagnosis driven. A hierarchical condition category (“HCC”) model is used to risk-adjust diagnoses, by grouping ICD-10 diagnosis codes by severity of condition and increased cost of care for treatment of enrollees with chronic diagnoses. The HCCs are additive in nature and produce a risk score. Risk adjustment allows CMS to redirect payments from managed-care organizations that target healthy populations to those that care for the most ill. By risk-adjusting plan payments, CMS can make appropriate payments for enrollees with differences in expected costs. As an enrollee’s risk score increases, the monthly risk-adjusted payment to the Medicare Advantage organization also increases. In this way, the risk-adjustment program compensates Medicare Advantage plans for the additional risk of providing coverage to enrollees expected to require more health-care resources.

    CMS Audits of Medicare Advantage Plans

    Under its authority to identify waste and mismanagement of federal health program dollars, CMS has been actively conducting audits on risk-adjustment submissions from Medicare Advantage organizations.

    There was little to no activity by CMS in terms of Medicare Advantage audits prior to 2019. However, in 2021, CMS recouped $223,043,005 in overpayments from six plans. The overpayment recouped from Humana in one audit totaled $197.7M (comprising 71 percent of the recoveries by the Office of Inspector General for the Department of Health and Human Services (HHS OIG) in 2021). In 2022, CMS recouped $134,739,612 in overpayments from twelve Medicare Advantage plans.

    This increased scrutiny stems from the fact that in 2019 the Medicare Advantage program provided health-care coverage for 23 million Americans (accounting for about a third of all Medicare beneficiaries). Health-care coverage under Medicare Advantage plans resulted in a total annual cost of $264 billion of the $758 billion total Medicare program costs spent in fiscal year 2019.

    Evolution of the Audit Rule

    The discussion below traces the changes in CMS audit methodology and reflects the expansion of RADV audits’ scope over time.

    Medicare Advantage Audit Methodology under the 2012 Final Rule

    Selection of Plans. The selection of plans for audit in 2012 was stratified. Under CMS’s approach, thirty Medicare Advantage plans were selected annually for audit, typically two to three years after payment. The contracts were targeted based on diagnosis coding intensity, which is the average change in risk score associated with reported beneficiary diagnoses covered by the Medicare Advantage contract. Coding intensity measures the extent to which the estimated medical needs of beneficiaries increase from year to year. The targeted contracts were those whose beneficiaries appeared to get sicker at a relatively rapid rate, based on the information submitted to CMS. Those contracts chosen by coding intensity were divided into three categories: high, medium, and low, with the same number of enrollees for each stratum.

    Beneficiary Sampling. The total number of enrollees sampled was up to, but often exceeded (see table below), 201 beneficiaries, with 67 enrollees per stratum. The categories of each stratum were based on the individual risk scores of the enrollees.

    Medical Record Collection and Review. After selecting the beneficiaries for review, CMS requested supporting documentation for all risk-adjusted diagnoses submitted in the past year. The Medicare Advantage plans were permitted to submit five medical records per audited risk-adjusted diagnosis. CMS contractors then reviewed the submitted medical records to determine if the medical records supported the diagnosis.

    Payment Error Calculation and Extrapolation. When a medical review was completed, CMS extrapolated an error rate for the entire population over the audited period. The extrapolated amount considered the sampling weight of each enrollee. The payment error was calculated by taking the difference between the actual amount paid based on the plan’s submitted diagnoses and the amount that would have been paid based on the RADV-validated diagnoses.

    Extrapolation meant that if an error was found during a RADV audit on an HCC, not only were the overpayments recouped on that plan member, but payment was recouped on all members who were in that HCC over the audited year(s). The annual payment error for each sampled enrollee was multiplied by the enrollee’s sampling weight (computed for each stratum). The weighted enrollee annual payment error was summed across all enrollees in the sample to determine the extrapolated payment error.

    In its prior final rule in 2012, CMS recognized the need to use an offset, the FFSA, to account “for the fact that the documentation standard used in RADV audits to determine a contract’s payment error (medical records) is different from the documentation standard used to develop the Part C risk-adjustment model (FFS claims).” The FFSA was intended to ensure that the amount due in a RADV audit considered the difference between audit review standards and the errors resulting from unsupported fee-for-service diagnostic codes, creating a permissible level of payment errors and limiting RADV audit recovery to payment errors above the set level. Under that 2012 CMS final rule, the FFSA was used to account for differences in the fee-for-service and Medicare Advantage documentation standards to ensure that there was no bias built in that resulted in underpayment to Medicare Advantage plans.

    The 2018 CMS Proposed Rule

    Highlights. CMS proposed eliminating the FFSA as part of the revised 2018 RADV audit methodology proposed rule. To support its proposal, CMS cited a 2018 internal study finding “that errors in FFS claims data do not have any systematic effect on the risk scores calculated by the CMS-HCC risk adjustment model, and therefore do not have any systematic effect on the payments made to [Medicare Advantage] organizations.” CMS’s proposed changes to the audit methodology, i.e., the elimination of the FFSA, would allow it to recover payments retroactively from audits conducted for plan years from 2011 forward without an offset.

    CMS also asserted its authority to use its discretion to identify different sampling methods and auditing techniques other than a stratified approach, including auditing by sub-cohorts. Auditing by sub-cohorts involves auditing by HCC, targeting diagnoses that CMS views as subject to high rates of improper payment. A sub-cohort represents a grouping of HCCs, such as HCCs 17, 18, and 19—the HCCs for the diagnosis of diabetes and its complications. The 2018 proposed rule recognized that using a sub-cohort method of auditing plans would allow CMS to use smaller sample sizes to calculate extrapolated overpayments.

    Litigation. In United Healthcare Insurance v. Becerra, the U.S. Court of Appeals for the D.C. Circuit rejected the United Healthcare challenges to the 2018 CMS RADV rule, finding that there was no valid legal or factual claim that CMS’s overpayment rule failed to comply with actuarial equivalence, affirming CMS’s agency authority to implement the 2018 RADV proposed rule as a final rule.

    Audits in 2021 and 2022: Combined Methodology of 2012 and 2018 Audits

    Below is a summary of some of the HHS OIG audits performed in 2021 and 2022 that combine the methodology of audits used in both 2012 and 2018 and represent varied approaches to the RADV audit process. CMS’s authority to conduct RADV audits is set out in 42 CFR 422.311 and has been applied by the HHS OIG in its performance of Medicare Advantage compliance audits.

    Medicare Advantage Plans Audited 2021–2022 (Subset) Years Audited # of Enrollees Selected  Extrapolated Amount of Overpayment
    UPMC Health Plan 2015–2016 280 $6.4 M
    Coventry Health Care of Missouri* 2014–2016 275 $584,005
    Anthem Community 2015–2016 203 $3.47 M
    Humana 2015 200 $197.7 M
    Humana Choice 2016–2017 270 $34.4 M
    Highmark Senior Health 2015–2016 226 $6.2 M
    Inter Valley Health 2018 200 $5.3 M
    BCBS of Oregon 2015–2016 179 $1.8 M
    WellCare of Florida 2015–2016 250 $3.5 M
    CIGNA HealthSpring of Florida* 2015 200 $39,612
    Cariten Health Plan 2016–2017 270 $9.2 M
    SCAN Health Plan 2015 240 $54.3 M

     

    Sources: UPMC Health Plan; Coventry Health Care of Missouri; Anthem Community; Humana; Humana Choice; Highmark Senior Health; Inter Valley Health; BCBS of Oregon; WellCare of Florida; CIGNA HealthSpring of Florida; Cariten Health Plan; SCAN Health Plan.

    Even at that time, there were inconsistencies in the audit approach. Only four of the audits above used a sample size of 200 or below; most used a significantly larger sample size. Some had more than one reference year from which the sample was drawn. All samples were drawn from reference years that were closed, i.e., they already had final reconciliations and were settled, mostly five to six years prior to the year of the audit. Two of the contract-level audits did not extrapolate the overpayments; several were targeted reviews of sub-cohorts of HCCs, while others followed a stratified sampling method.

    The 2023 RADV Audit Final Rule

    Highlights. Below are the highlights of the most recent final rule, effective February 1, 2023:

    • CMS will no longer apply a risk-adjustment factor, the FFSA, in RADV audits, meaning that plans will no longer have an offset against the extrapolated amount determined in the RADV audit.
    • CMS will no longer be limited in either the audit methodology used to conduct RADV audits or its extrapolation of payment errors. CMS is “not adopting any specific sampling or extrapolated audit methodology, but will rely on any statistically valid method for sampling and extrapolation that is determined to be well-suited to a particular audit.” CMS will extrapolate RADV audit findings under its new methodology beginning with plan year 2018, and that approach will not apply to any plan years prior to that.
    • Payer challenges to CMS and HHS OIG audit methodology since the 2023 RADV Final Rule have focused on the lack of a consistent approach.
      • Two payers audited in 2023, MCS Advantage (“MCS”) and Excellus Health Plan, Inc. (“Excellus”), have challenged changes to audit methodology by arguing that their audits involved flawed audit sampling, inconsistent with CMS’s actuarial equivalent mandate and its requirements for data accuracy and compliance. The MCS audit challenged the sampling methodology on grounds that it was “biased to identify overpayments.” HHS did not seek to identify or account for all potential unrelated HCCs that were not submitted but were reported to CMS, thus omitting data that represented potential underpayments. HHS responded by stating its analysis “is now limited to the net overpayments associated with the sampled enrollee-years” and that a valid estimate “does not need to take into consideration all potential HCCs or underpayments within the audit period.”
      • MCS and Excellus also challenged the audit analysis as employing a shifting audit methodology, arguing there is no consistency in the selection of the method of identifying high-risk diagnoses for review. Excellus noted that in its audit, four cancer diagnoses were selected as HCCs targeted for review, while in other compliance audits affecting other payers, none were selected. It also argued that a “high-risk” diagnosis code is nowhere defined, though HHS argued it provided information on the parameters used.
      • Further, both payers argued that actuarial equivalence between Medicare Advantage and traditional Medicare payments is required as part of the calculation of estimated overpayments, and that HHS did not meet this requirement due to its not applying an FFSA or other mechanism to account for its risk adjustment model being based on unaudited traditional Medicare data. These challenges were dismissed by HHS, based on CMS’s statement that application of an adjustment factor in RADV audits is no longer required.
      • MCS and Excellus also contended that other aspects of the current audit methodology are at odds with the risk adjustment model. MCS and Excellus argued the use of a physician as a tiebreaker when medical review contractors cannot determine whether a reported HCC represents an overpayment deviated from the CMS risk adjustment program requirements, which base overpayments on the inaccurate assignment of ICD 10 codes, not the clinical judgment of a physician reviewer. Excellus asserted that HHS failed to use a proper notice and rulemaking process to establish its audit standards because its audit departed from CMS’s established risk adjustment audit standards. The use of such standards made the audit “procedurally defective, arbitrary and capricious” in Excellus’s view, though HHS disagreed.

    Impact. Plans and providers can expect the following:

    • The number of RADV audits will increase because of CMS’s use of either sub-cohort audits or Unified Program Integrity Contractors (“UPIC”) auditors to perform Medicare Advantage audits. CMS will use UPICs to select Medicare Advantage plan enrollees for review, identify underpayments and overpayments associated with diagnosis data submitted to CMS, and calculate the final over-/underpayment amount. CMS intends for all Medicare Advantage plans to be subject to either a comprehensive or condition-specific RADV audit each plan year. There is expected to be an increase in targeted reviews, which would allow CMS to base audits on smaller sample sizes, permitting it to increase the number of audits performed. This would increase the burden on providers to respond to record requests and also widen the spectrum of provider liability for those providers who are parties to risk-sharing arrangements.
    • The new methods of extrapolation of overpayments from 2018 forward will potentially subject providers who participated in risk-sharing arrangements to exposure to increased, unexpected losses, where they participated as an in-network provider during the earlier periods and a final reconciliation has already taken place. They also could expect reduced income where a RADV audit has resulted in recoupment of overpayments from a plan year where no final reconciliation has occurred. While providers face a contractual risk of liability as part of the recoupment of overpayments from plans, they also could face liability under the False Claims Act to the extent they benefited financially from inflating revenues.
    • An increase in the number of RADV audits will likely lead to additional scrutiny of physician documentation. Certain clinical documentation and billing practices can be an indicator of an overpayment. Diagnoses that cannot be validated either because they are clinically unsupported or have resolved could result in RADV audit findings. Managing risk in this area can protect physicians against not only liability for overpayment under a risk-sharing arrangement but also direct liability under the False Claims Act for “potential fraud actions.”
    • As plan revenues become more uncertain due to plans’ inability to adjust for potential recoupment of overpayments, premiums may increase as one way to address that uncertainty, and enrollee decision-making as to plan options and participation could be impacted. That change, coupled with increased provider exposure to liability due to risk-sharing arrangements, may impact provider decisions to accept Medicare Advantage enrollees. A decision to no longer accept Medicare Advantage patients, while driven by revenue considerations, may have other revenue consequences for physicians who fail to factor in the potential loss of revenues from other sources, i.e., providers who refer patients to them based on their acceptance of Medicare Advantage insurance.
    • Providers will likely be subject to increasing demand to respond to requests from plans to comply with audit requirements.
    • Plans will likely conduct increased prospective audits on providers’ coding and charting to improve the accuracy of ICD-10 coding.

    Guidance for Ensuring Compliance with the 2023 RADV Audit Requirements

    Plans and providers should perform billing compliance audits to ensure the accuracy and completeness of the coding of claims and to affirm that diagnosis codes are clinically supported.

    A plan has twenty-five weeks to submit medical records to CMS in response to an audit request. There is a large amount of information involved in a RADV audit, as well as a fixed deadline. Efficiently managing time and use of software tools enables both the provider and the plan to capture and track pertinent information.

    Plans must be aware of the timetable to appeal RADV audit findings. Plans must file a written request with CMS for an appeal of the RADV audit report (the medical record review determination or the payment error calculation) within sixty days of its issuance.

    Conclusion

    The impact of the 2023 RADV audit final rule extends beyond Medicare Advantage payer pricing and the Medicare Advantage bid process. Providers who are parties to risk-sharing arrangements face unexpected risk in the form of loss of revenue from audited periods where final reconciliations have occurred. The contractual risks of recoupment of overpayments sought from earlier plan periods alone may be sufficient for some providers to no longer accept enrollees as patients. Further, increased premiums built into future bids may affect patient choice in terms of the plans selected; more importantly, the increased cost of the program to the plans may restrict the availability of services, ultimately impacting the patients for whom the program was created.

      Author